be98fe117b2e6c298ab9fa5ad69dc8564b68adaeeeb619b781abc5c97dc576a7

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

991c99e254f17918869be51a55992927_JaffaCakes118.html
Size

2KB
MD5

991c99e254f17918869be51a55992927
SHA1

732c910bf59f59a44afc7f947d17f41911b05aa6
SHA256

be98fe117b2e6c298ab9fa5ad69dc8564b68adaeeeb619b781abc5c97dc576a7
SHA512

58b4baf6b4d757d4b609410bd004ac25c4e32e54c7ca56c2dbd8d13c1f731ee6ea315df59dcae812afed72e4cb773f00255c8a637d9765c10721898f819ae984

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{383CAE61-2377-11EF-9A67-52FD63057C4C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423779909"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3044	2424	iexplore.exe	28
PID 2424 wrote to memory of 3044	2424	iexplore.exe	28
PID 2424 wrote to memory of 3044	2424	iexplore.exe	28
PID 2424 wrote to memory of 3044	2424	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\991c99e254f17918869be51a55992927_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65784a3ba00c2d563efc49f3910eea7a

SHA1
b34642a834c0f3a491e705479c89ca196d855b5b

SHA256
cbc02fb532849641f3517458128e5c9c3f1559466acd9bba5bdb0e72cfdea2fa

SHA512
3f8597e9bd7376839c2fb978bc05c625b7ff91d3c4b74247e355d26d7e6f3a00bab9b526928fb1b5f97c6b35b4857850482e3b6b0b9698b4e2c2d17fb1c7d651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50e8fdd64e5b77aec715921ecbb71976

SHA1
2d76c0651ac55ef087ce07fec0840b0dc77dc0c8

SHA256
952731634c63c2d728fe5aaa5d409e00eb07e9d05ca4d218d5584f31de46a95f

SHA512
48159083b8fcde48d319391765ae97851bfe08c568e6682d33409ddf965cedc55612b7c7a1977e5bb0f1b1a87fbbebf123e63f2adc9bf37a19049aba58868ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1de0772f165dedb0b50d76cf8e46bdf0

SHA1
58981df652b0d9e53da1308384a6ec48a3ba796a

SHA256
d74ef3e6054530a00e8bac7259c30b0a725ab27f6a7e03533c17fc053b70125a

SHA512
fd43cb6a4802bca3085a0b1be31f942898dd2fa07aaa0fd3de9392121aa408005e5ce50f3490b5d8708183f8ee1dbc4ab6e75e701ad13aa89e330bbda80e5a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f4a3be54f69c132babfd0e34e750a43

SHA1
018c1168445fc10c9534b49743360dae7dfd4901

SHA256
7c363b533b40262d7f7e448bb617b22c164eafbb79f264d3b2c9a8224dbf34d8

SHA512
b23f2edb5b3a4e3be239aac0b7d57c27c9281fcd938d0d69a09c7aa902724ba4e50d3b5a69b75adf7559751ca58f909a2ada8bbf780d8e7da7575b001b23bf4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2f7d31bcbcd93386c19553535e98292

SHA1
8dd19a27e430ac3bccf914d402141e1d690c42fb

SHA256
dbce8976501cb3c947bbe20f69ea9afcf7223a96563ed1529767064ca9c0ff8d

SHA512
43f1b2797c3b581a16d8d33c7c7fc168979f45d57fd4312060562d4eb86c1a3b2285bf9fac76a2669e763a350e37176fe04c40fc2c8a8f2b72c3f2ca0819048f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab800de5a0780b051c7956d29a2b7714

SHA1
be43ae6103913f07ad99c0ed86ae2e5192f032a2

SHA256
933a92dcefab609219aa9193fb47cfb86e90b9315e40765be2d470bb63081d4e

SHA512
15b8bbd36a92ad442305ef3925f47a2bca3a8d41893fe54acc50d36c3761913642ac0746aac0b84c7ae567175a16b3354acd87ad805416e9a72ee623a10e3ffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d85bc45064c7e36de008675e800c44f1

SHA1
60e5e1453dae9c0dd6b7ae121fd6c2b22720d969

SHA256
0727644ab2f8139720f1c3ac4ef76591d2154bece2774e882089b766522287b8

SHA512
c0f5e1f7546d36b3526a2f7730e616105988baf7d88d6713ef5a44ebd3f1324d4a726626328a613ef51bc2d726784318238da35ec664fb15b3550c43a26db6f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c83baecc2df5eb5b1cd920b13c6f887

SHA1
b328a40a618cf367402848bf66ebf4ee75d47ad8

SHA256
7433181b165a34d6612e57a4bc8ad45a9967f4e4f0ba1aac3e1c5ed2e8a4b7f9

SHA512
3bff01d6221a8f95fcb8d5e68fb000c7c1efbfb14861298bc5ebc0202927298ffdb461d31ee3f3c52957e2899ae57b2701063a634f793c07895660b3f01ef331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d24875c3431cb251cc6a8c6ebd7ef56

SHA1
f24bb81a81607f8fd24a3761eea28c7fa8ce0825

SHA256
3b78774b2a9b8396eb9f64c9aeaba70494af11c5eb288408f07e4d9a3a338c03

SHA512
7fa86516762c77581568e108f665d9bc3cc38fa803401831dcb56e4df68891ccb9cf535a02daddd8749a3335b857874f111697dca3dc110a0a3253cc5dfbf199

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab437.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4EA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit